#include "stdafx.h"
#include "mem_nt.h"


//
// Functions in NTDLL that we dynamically locate
//

typedef NTSTATUS (__stdcall *NtUnmapViewOfSection)(IN HANDLE  ProcessHandle,IN PVOID  BaseAddress);
typedef NTSTATUS (__stdcall *NtOpenSection)(OUT PHANDLE  SectionHandle,IN ACCESS_MASK  DesiredAccess,IN POBJECT_ATTRIBUTES  ObjectAttributes);
typedef NTSTATUS (__stdcall *NtMapViewOfSection)(
	 IN HANDLE  SectionHandle,
	 IN HANDLE  ProcessHandle,
	 IN OUT PVOID  *BaseAddress,
	 IN ULONG  ZeroBits,
	 IN ULONG  CommitSize,
	 IN OUT PLARGE_INTEGER  SectionOffset,	/* optional */
	 IN OUT PULONG  ViewSize,
	 IN SECTION_INHERIT  InheritDisposition,
	 IN ULONG  AllocationType,
	 IN ULONG  Protect
);
typedef VOID (__stdcall *RtlInitUnicodeString)(IN OUT PUNICODE_STRING  DestinationString,IN PCWSTR  SourceString);
typedef ULONG (__stdcall *RtlNtStatusToDosError) (IN NTSTATUS Status);
typedef PHYSICAL_ADDRESS(__stdcall *MmGetPhysicalAddress) (PVOID BaseAddress);



RtlInitUnicodeString g_fnRtlInitUnicodeString = (RtlInitUnicodeString) 
	   GetProcAddress( GetModuleHandle("ntdll.dll"), "RtlInitUnicodeString" );
NtUnmapViewOfSection g_fnNtUnmapViewOfSection = (NtUnmapViewOfSection) 
	   GetProcAddress( GetModuleHandle("ntdll.dll"), "NtUnmapViewOfSection" );
NtOpenSection g_fnNtOpenSection = (NtOpenSection) 
	   GetProcAddress( GetModuleHandle("ntdll.dll"), "NtOpenSection" );
NtMapViewOfSection g_fnNtMapViewOfSection = (NtMapViewOfSection) 
	   GetProcAddress( GetModuleHandle("ntdll.dll"), "NtMapViewOfSection" );
RtlNtStatusToDosError g_fnRtlNtStatusToDosError = (RtlNtStatusToDosError) 
	   GetProcAddress( GetModuleHandle("ntdll.dll"), "RtlNtStatusToDosError" );
MmGetPhysicalAddress g_fnMmGetPhysicalAddress;

	
//--------------------------------------------------------
//
// LocateNtdllEntryPoints
//
// Finds the entry points for all the functions we 
// need within NTDLL.DLL.
//
//--------------------------------------------------------
BOOLEAN LocateNtdllEntryPoints()
{
	// 
	// 
	// 
	HMODULE hNT = LoadLibrary("ntoskrnl.exe");
	if (!hNT)
		return FALSE;
	if( !(g_fnMmGetPhysicalAddress = (MmGetPhysicalAddress)
		GetProcAddress( hNT,"MmGetPhysicalAddress" )) )
	{
		return FALSE;
	}
	FreeLibrary(hNT);
	
	return TRUE;
}


NTSTATUS BBNtMapViewOfSection(
	IN HANDLE  SectionHandle,
	IN HANDLE  ProcessHandle,
	IN OUT PVOID  *BaseAddress,
	IN ULONG  ZeroBits,
	IN ULONG  CommitSize,
	IN OUT PLARGE_INTEGER  SectionOffset,	/* optional */
	IN OUT PULONG  ViewSize,
	IN SECTION_INHERIT  InheritDisposition,
	IN ULONG  AllocationType,
	IN ULONG  Protect
)
{
	if (!g_fnNtMapViewOfSection)
		return -1;
	return g_fnNtMapViewOfSection(
		SectionHandle,
		ProcessHandle,
		BaseAddress,
		ZeroBits,
		CommitSize,
		SectionOffset,
		ViewSize,
		InheritDisposition,
		AllocationType,
		Protect);
}

NTSTATUS BBNtUnmapViewOfSection(
	IN HANDLE ProcessHandle,
	IN PVOID  BaseAddress)	
{
	if (!g_fnNtUnmapViewOfSection)
		return -1;
	return g_fnNtUnmapViewOfSection(ProcessHandle, BaseAddress);
}

VOID BBRtlInitUnicodeString(
	IN OUT PUNICODE_STRING DestinationString,
	IN PCWSTR SourceString)
{
	g_fnRtlInitUnicodeString(
		DestinationString,
		SourceString);
}

NTSTATUS BBNtOpenSection(
	OUT PHANDLE SectionHandle,
	IN ACCESS_MASK DesiredAccess,
	IN POBJECT_ATTRIBUTES ObjectAttributes)
{
	if (!g_fnNtOpenSection)
		return -1;
	return g_fnNtOpenSection(SectionHandle, DesiredAccess, ObjectAttributes);
}


PHYSICAL_ADDRESS BBMmGetPhysicalAddress(IN PVOID BaseAddress)
{
	PHYSICAL_ADDRESS add;
	if (!g_fnMmGetPhysicalAddress)
	{
		add.QuadPart = -1;
		return add;
	}
	return g_fnMmGetPhysicalAddress(BaseAddress);
}

ULONG BBRtlNtStatusToDosError(IN NTSTATUS Status)
{
	if (!g_fnRtlNtStatusToDosError)
		return -1;
	return g_fnRtlNtStatusToDosError(Status);
}


//////////////////////////////////////////////////////////////////////////
